2035 matches found
CVE-2019-16330
In NCH Express Accounts Accounting v7.02, persistent cross site scripting XSS exists in Invoices/Sales Orders/Items/Customers/Quotes input field. An authenticated unprivileged user can add/modify the Invoices/Sales Orders/Items/Customers/Quotes fields parameter to inject arbitrary JavaScript...
CVE-2019-16330
In NCH Express Accounts Accounting v7.02, persistent cross site scripting XSS exists in Invoices/Sales Orders/Items/Customers/Quotes input field. An authenticated unprivileged user can add/modify the Invoices/Sales Orders/Items/Customers/Quotes fields parameter to inject arbitrary JavaScript...
CVE-2019-16330
CVE-2019-16330 affects NCH Express Accounts Accounting v7.02, with a persistent XSS in Invoices/Sales Orders/Items/Customers/Quotes input fields. An authenticated unprivileged user can modify these fields to inject arbitrary JavaScript, enabling client-side script execution. Connected documents c...
CVE-2019-16330: Improper Neutralization of Input During Web Page Generation
In NCH Express Accounts Accounting v7.02, persistent cross site scripting XSS exists in Invoices/Sales Orders/Items/Customers/Quotes input field. An authenticated unprivileged user can add/modify the Invoices/Sales Orders/Items/Customers/Quotes fields parameter to inject arbitrary JavaScript...
UBUNTU-CVE-2017-1002201
In haml versions prior to version 5.0.0.beta.2, when using user input to perform tasks on the server, characters like " ' must be escaped properly. In this case, the ' character was missed. An attacker can manipulate the input to introduce additional attributes, potentially executing code...
Cross site scripting
In NCH Express Invoice v7.12, persistent cross site scripting XSS exists via the Invoices/Items/Customers/Quotes input field. An authenticated unprivileged user can add/modify the Invoices/Items/Customers fields parameter to inject arbitrary JavaScript...
CVE-2019-16282
In NCH Express Invoice v7.12, persistent cross site scripting XSS exists via the Invoices/Items/Customers/Quotes input field. An authenticated unprivileged user can add/modify the Invoices/Items/Customers fields parameter to inject arbitrary JavaScript...
PT-2019-14611
Name of the Vulnerable Software and Affected Versions NCH Express Invoice version 7.12 Description The issue concerns a persistent cross-site scripting XSS flaw. This flaw can be exploited via the input fields for Invoices, Items, Customers, and Quotes. An authenticated, unprivileged user can...
Express Invoice 7.12 Cross Site Scripting
Exploit Title: Express Invoice 7.12 - 'Customer' Persistent Cross-Site Scripting Exploit Author: Debashis Pal Date: 2019-10-13 Vendor Homepage: https://www.nchsoftware.com/ Source: https://www.nchsoftware.com/invoice/index.html Version: Express Invoice v7.12 CVE : N/A Tested on: Windows 7 SP132bi...
CVE-2019-16282: Improper Neutralization of Input During Web Page Generation
In NCH Express Invoice v7.12, persistent cross site scripting XSS exists via the Invoices/Items/Customers/Quotes input field. An authenticated unprivileged user can add/modify the Invoices/Items/Customers fields parameter to inject arbitrary JavaScript...
Express Invoice 7.12 - (Customer) Persistent Cross-Site Scripting Vulnerability
Exploit for php platform in category web applications Exploit Title: Express Invoice 7.12 - 'Customer' Persistent Cross-Site Scripting Exploit Author: Debashis Pal Vendor Homepage: https://www.nchsoftware.com/ Source: https://www.nchsoftware.com/invoice/index.html Version: Express Invoice v7.12 C...
SugarCRM Quotes Module SQL Injection Vulnerability
SugarCRM is a set of open source customer relationship management software . A SQL injection vulnerability exists in the Quotes module of SugarCRM. The vulnerability stems from a lack of input validation. An attacker can exploit this vulnerability to inject custom PHP code...
CVE-2019-17297
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Quotes module by a Regular user...
CVE-2019-17297
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Quotes module by a Regular user...
Sql injection
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Quotes module by a Regular user...
CVE-2019-17297
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Quotes module by a Regular user...
CVE-2019-17297
CVE-2019-17297 affects SugarCRM before 8.0.4 and 9.x before 9.0.2, where a Regular user can trigger SQL injection in the Quotes module. The root cause across connected sources is inadequate input validation leading to SQL injection, with multiple references confirming the Quotes module as the vul...
CVE-2019-17297: Improper Neutralization of Special Elements used in an SQL Command
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Quotes module by a Regular user...
PT-2019-15060
Name of the Vulnerable Software and Affected Versions SugarCRM versions prior to 8.0.4 SugarCRM versions 9.x prior to 9.0.2 Description The issue allows SQL injection in the Quotes module by a Regular user. Recommendations For SugarCRM versions prior to 8.0.4, update to version 8.0.4 or later. Fo...